PECB ISO 28000 Lead Auditor cheat sheet

ISO 28000 is a management-system standard for security assurance in supply chains; it follows the same high-level structure (HLS) as ISO 9001, ISO 14001 and ISO 27001, so clauses 4-10 map one-to-one across these standards.

The standard applies to organizations of any size that need to assure security of people, assets, information, and continuity of supply, whether they own the risks or must manage them through suppliers and partners.

Key vocabulary: 'security' means resistance to intentional, unintentional, or natural threats; 'risk' is the effect of uncertainty on objectives; 'security risk' combines likelihood and consequence of a security event.

ISO 28000 does not prescribe specific controls; it requires the organization to identify, assess, and treat risks, so the control set is context-driven and can reference ISO 28001, ISO 28002, or ISO 31000.

PDCA underpins the standard: Plan (clauses 4-6), Do (7-8), Check (9), Act (10). Auditors classify findings by where the requirement sits in this cycle.

Management commitment is not a slogan: top management must establish the security policy, assign roles, provide resources, and integrate security into business processes (clause 5).

The standard emphasizes a 'security management system' (SMS) as a set of interrelated elements, not a standalone department; documentation may be electronic and the extent depends on organization size and complexity.

Continual improvement (clause 10) is judged by evidence of measurable improvement, not by the existence of a corrective-action register alone.

Certification is third-party conformity assessment; accreditation (e.g., by a national body under ISO/IEC 17021-1) is the credential of the certification body, not of the audited organization.

Clause 4 Context: the organization must determine external and internal issues, interested parties and their security requirements, and define the SMS scope, which must be documented and available.

Clause 5 Leadership: top management must issue a security policy appropriate to purpose, provide a framework for objectives, include commitment to satisfy applicable requirements and continual improvement, and be communicated internally.

Clause 6 Planning: risk assessment must identify security threats and vulnerabilities, evaluate consequences, and determine controls; objectives must be measurable, monitored, and consistent with the policy.

Clause 7 Support: resources, competence, awareness, communication, and documented information must be controlled, including creation, update, distribution, and retention.

Clause 8 Operation: the organization must plan and control processes needed to meet requirements, manage outsourced processes, and prepare for and respond to security incidents and emergencies.

Clause 9 Performance evaluation: monitoring, measurement, analysis, internal audit, and management review must be planned with defined frequency, methods, and criteria.

Clause 10 Improvement: nonconformity and corrective action must address root cause; the organization must retain documented information on the nature of nonconformities and results of action.

A documented information requirement exists only where the standard explicitly says 'maintain' (procedures/records) or 'retain' (evidence); auditors must not invent documentation requirements.

Audit definition (ISO 19011): systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively against audit criteria to determine the extent of conformity.

Seven audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach.

Audit types: first-party (internal), second-party (supplier/customer), third-party (certification/regulatory); each has different independence and reporting relationships.

Audit criteria are the set of policies, procedures, or requirements used as a reference; audit evidence is records, statements, or observations verified to be true.

A finding is a result of evaluating evidence; nonconformity is the failure to meet a requirement, while an observation or opportunity for improvement is not a nonconformity.

Competence of auditors requires education, training, experience, and personal attributes; ISO 19011 Annex A provides guidance on knowledge and skills for audit team members.

Sampling risk and the risk of the audit itself must be managed; auditors use a risk-based approach to allocate time and depth to higher-risk processes.

Audit evidence must be recorded and traceable; verbal statements alone are weak evidence and should be corroborated by records or observation.

Audit programme vs audit plan: the programme covers a set of audits over a cycle; the plan covers one audit and includes objectives, scope, criteria, dates, sites, and team roles.

Document review before the audit should establish the SMS scope, security policy, risk assessment methodology, and the list of applicable legal and other requirements.

Audit criteria for an ISO 28000 audit typically include ISO 28000 clauses 4-10, the organization's own SMS documentation, contractual security requirements, and applicable legal requirements.

The audit plan should be risk-based, allocating more time to high-risk processes such as access control, incident response, supplier security, and business continuity.

Checklists are aids, not scripts; they must be derived from the audit criteria and the process approach, not copied from a generic template.

Opening meeting agenda: introduce participants, confirm scope and criteria, explain audit methods and sampling, confirm communication channels, and clarify that findings are preliminary until the closing meeting.

Audit team selection must consider competence in security risk, supply-chain operations, and the sector; technical experts may support but do not audit as lead auditors.

The audit plan must be communicated and agreed with the auditee, but the auditor retains authority over sampling and evidence collection.

Evidence collection methods: interviews, observation of activities, review of documented information, and sampling of records; each should be recorded with source, date, and location.

Trace a process end-to-end: follow a shipment, a visitor, or an incident from initiation to closure and verify the controls at each handoff.

Interview technique: ask open questions, probe for examples, verify with records, and avoid leading questions that suggest the expected answer.

Evaluate conformity against the exact clause text; do not substitute personal preference or industry practice for the requirement.

Nonconformity grading: major (systemic failure or absence of a required element), minor (isolated lapse), observation (potential improvement, no requirement breached).

When a nonconformity is identified, record the requirement, the objective evidence, and the site/process; do not prescribe the corrective action in the finding.

Verify that risk assessment outputs actually drive controls; a common gap is a risk register that is not linked to operational controls or objectives.

Audit trails: if a document is revised during the audit, note the version reviewed and the date; evidence must be traceable to the audit record.

Time management: track progress against the plan, escalate access or evidence refusals to the auditee's management, and document any scope limitation.

Closing meeting: present findings, explain the grading rationale, allow the auditee to ask questions, and clarify that the audit team does not decide certification.

Audit report content: objectives, scope, criteria, dates, team, summary of findings, nonconformities with evidence, and conclusions on conformity and effectiveness.

Corrective action requests should be tracked with root cause, correction, corrective action, responsible person, and due date; the auditor verifies closure.

Follow-up audits may be required for major nonconformities before certification or continued certification; the certification body decides based on evidence.

Records retention: audit reports, notes, and evidence must be retained per the audit programme and confidentiality agreements.

The report must be factual and free of opinion; use neutral language and cite the requirement and evidence for each nonconformity.

If the audit was terminated or scope reduced, the report must state the reason and the effect on the audit conclusions.

Confidentiality: information obtained during the audit must not be disclosed without authorization, and the report distribution list should be agreed in advance.

Audit programme (ISO 19011 clause 5): establish objectives, extent, and risk-based schedule; identify resources; and monitor and review the programme for improvement.

Programme frequency should reflect the risk profile, size, complexity, and results of previous audits; high-risk or poor-performing areas get shorter intervals.

Programme records: audit plans, reports, nonconformity logs, auditor competence records, and management review of the programme's performance.

Competence management: maintain auditor qualification records, including training, experience, and sector knowledge, and assign auditors based on competence, not availability.

Independence: auditors must not audit their own work; for internal audits, use cross-functional auditors or external resources where independence is at risk.

Performance indicators for the programme include on-time completion, finding closure rate, repeat nonconformities, and stakeholder feedback.

The programme must be reviewed at planned intervals and adjusted for changes in the organization's context, risks, and legal requirements.

Coordination with other management-system audits (e.g., ISO 9001, ISO 14001) can use integrated audits, but the ISO 28000 criteria must still be fully covered.